Hello, welcome to the Friday, October 27th, 2017 edition of the Sansonet Storm Center's Stormcast. My name is Johannes Ulrich, and I'm recording from Berlin, Germany.

Kasperski has, of course, been in the news recently, and I haven't really talked much about that story, because most of it really was more political than

technical. But Kaspersky now released a report of its internal investigation, which I think

makes some important points that you have to keep in mind with anti-malware products, and

that anti-malware products will occasionally send a file that they consider

suspicious back to the anti-malware company. At least this is what Kasperski suggests

happened in this particular case back in 2014 with an employee for the NSA developing exploits on a home computer that ran Kaspersky's

anti-malware software. This is an issue pretty much with any anti-malware company that they

may use their software to collect samples. Also, of course, with any web-based services that you are using to submit samples to,

VirusTotal, for example, makes it very clear that any samples being submitted to it

will be shared with researchers and other anti-malware vendors. Many modern anti-malware systems also depend on

constant network connectivity, for example, hatches of files are being sent via DNS and the like

in order to get a more real-time detection of any suspicious files.

And another big story, of course, the last few days was the RACA vulnerability.

RACA refers to the vulnerable RASA keys generated by many Infineon chips. This affected a wide range of hardware components,

for example, smart cards, but also trusted platform modules or TPM chips. If your system is

using one of the affected chips, then you need to update its firmware in order to actually receive good keys.

Now, even after you do update the firmware, you still need to create new keys in order to make sure that your system is secure.

In particular, if you are using these keys, for example,

to protect hard drive encryption keys. To make it easier to figure out if your system is secure,

there is now a fairly simple test script that you can use in order to check the keys on your

system. This particular script will retrieve the public key from your TPM module and check if it is

...